pom.xml

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <groupId>org.spdx</groupId>
    <artifactId>spdx-tools</artifactId>
    <version>2.1.17-SNAPSHOT</version>

    <name>SPDX tools</name>
    <description>SPDX tools</description>

    <licenses>
        <license>
            <name>The Apache Software License, Version 2.0</name>
            <url>http://www.apache.org/licenses/LICENSE-2.0.txt</url>
            <distribution>repo</distribution>
        </license>
    </licenses>
    <url>http://spdx.org/tools</url>

    <developers>
        <developer>
            <id>goneall</id>
            <name>Gary O'Neall</name>
            <email>gary@sourceauditor.com</email>
            <organization>SPDX</organization>
            <organizationUrl>http://spdx.org</organizationUrl>
        </developer>
    </developers>
    <organization>
        <name>Linux Foundation</name>
        <url>http://www.linuxfoundation.org</url>
    </organization>

    <scm>
        <url>https://github.com/spdx/tools</url>
        <connection>scm:git:ssh://git@github.com:spdx/tools.git</connection>
        <developerConnection>scm:git:ssh://git@github.com:spdx/tools.git</developerConnection>
    </scm>

    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <maven.compiler.release>11</maven.compiler.release>
        <jena.version>3.10.0</jena.version>
    </properties>

    <dependencies>
        <!-- JENA -->
        <dependency>
        <!-- Force the dependency version greater or equal to 0.11.0 for Jena - resolves vulnerability -->
            <groupId>org.apache.thrift</groupId>
            <artifactId>libthrift</artifactId>
            <version>0.14.0</version>
            <type>pom</type>
        </dependency>
        <dependency>
        <!-- Force the dependency version to 2.12.7.1 for Jena - resolves vulnerability -->
            <groupId>com.fasterxml.jackson.core</groupId>
            <artifactId>jackson-databind</artifactId>
            <version>2.12.7.1</version>
        </dependency>
        <dependency>
        <!-- Force the dependency version to 1.26.0 for Jena - resolves vulnerability -->
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-compress</artifactId>
            <version>1.26.0</version>
        </dependency>
        <dependency>
           <groupId>org.apache.jena</groupId>
           <artifactId>apache-jena-libs</artifactId>
           <version>${jena.version}</version>
           <type>pom</type>
        </dependency>
        <dependency>
           <groupId>org.apache.jena</groupId>
           <artifactId>jena-iri</artifactId>
           <version>${jena.version}</version>
           <type>jar</type>
         </dependency>
        <dependency>
            <groupId>org.antlr</groupId>
            <artifactId>antlr</artifactId>
            <version>3.4</version>
        </dependency>
        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-lang3</artifactId>
            <version>3.1</version>
        </dependency>
        <dependency>
            <groupId>org.apache.poi</groupId>
            <artifactId>poi</artifactId>
            <version>4.1.1</version>
        </dependency>
        <dependency>
            <groupId>org.apache.poi</groupId>
            <artifactId>poi-ooxml</artifactId>
            <version>3.17</version>
        </dependency>
        <dependency>
            <groupId>net.sf.opencsv</groupId>
            <artifactId>opencsv</artifactId>
            <version>2.3</version>
        </dependency>
        <dependency>
            <groupId>nu.validator.htmlparser</groupId>
            <artifactId>htmlparser</artifactId>
            <version>1.4</version>
        </dependency>
        <dependency>
            <groupId>net.sf.saxon</groupId>
            <artifactId>saxon</artifactId>
            <version>8.7</version>
        </dependency>
        <dependency>
            <groupId>org.jsoup</groupId>
            <artifactId>jsoup</artifactId>
            <version>1.15.3</version>
        </dependency>
        <dependency>
            <groupId>com.google.guava</groupId>
            <artifactId>guava</artifactId>
            <version>32.0.0-jre</version>
        </dependency>
        <dependency>
            <groupId>com.github.spullara.mustache.java</groupId>
            <artifactId>compiler</artifactId>
            <version>0.7.9</version>
        </dependency>
        <dependency>
            <groupId>org.apache.logging.log4j</groupId>
            <artifactId>log4j-api</artifactId>
            <version>2.10.0</version>
        </dependency>
        <dependency>
            <groupId>org.apache.logging.log4j</groupId>
            <artifactId>log4j-core</artifactId>
            <version>2.17.1</version>
        </dependency>
        <dependency>
            <groupId>org.apache.logging.log4j</groupId>
            <artifactId>log4j-slf4j-impl</artifactId>
            <version>2.10.0</version>
        </dependency>
        <dependency>
            <groupId>junit</groupId>
            <artifactId>junit</artifactId>
            <version>4.13.1</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>com.google.code.gson</groupId>
            <artifactId>gson</artifactId>
            <version>2.8.9</version>
        </dependency>
        <dependency>
            <groupId>net.sf.saxon</groupId>
            <artifactId>saxon-dom</artifactId>
            <version>8.7</version>
        </dependency>
        <dependency>
            <groupId>com.github.cliftonlabs</groupId>
            <artifactId>json-simple</artifactId>
            <version>2.3.1</version>
        </dependency>
    </dependencies>

    <build>
        <plugins>
            <plugin>
                <groupId>org.spdx</groupId>
                <artifactId>spdx-maven-plugin</artifactId>
                <version>@project.version@</version>
                <executions>
                    <execution>
                        <id>build-spdx</id>
                        <phase>prepare-package</phase>
                        <goals>
                            <goal>createSPDX</goal>
                        </goals>
                    </execution>
                </executions>
                <configuration>
                    <spdxFile>LICENSE.spdx</spdxFile>
                    <spdxDocumentNamespace>http://spdx.org/documents/spdx-tools${project.version}</spdxDocumentNamespace>
                    <nonStandardLicenses>
                        <nonStandardLicense>
                            <licenseId>LicenseRef-CyberNeko</licenseId>
                            <extractedText>The CyberNeko Software License, Version 1.0

 
(C) Copyright 2002-2005, Andy Clark.  All rights reserved.
 
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:

1. Redistributions of source code must retain the above copyright
   notice, this list of conditions and the following disclaimer. 

2. Redistributions in binary form must reproduce the above copyright
   notice, this list of conditions and the following disclaimer in
   the documentation and/or other materials provided with the
   distribution.

3. The end-user documentation included with the redistribution,
   if any, must include the following acknowledgment:  
     "This product includes software developed by Andy Clark."
   Alternately, this acknowledgment may appear in the software itself,
   if and wherever such third-party acknowledgments normally appear.

4. The names "CyberNeko" and "NekoHTML" must not be used to endorse
   or promote products derived from this software without prior 
   written permission. For written permission, please contact 
   andyc@cyberneko.net.

5. Products derived from this software may not be called "CyberNeko",
   nor may "CyberNeko" appear in their name, without prior written
   permission of the author.

THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR OTHER CONTRIBUTORS
BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, 
OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT 
OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR 
BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, 
WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE 
OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, 
EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

====================================================================

This license is based on the Apache Software License, version 1.1.</extractedText>
                            <name>The CyberNeko Software License, Version 1.0</name>
                        </nonStandardLicense>
                    </nonStandardLicenses>
                    <defaultFileCopyright>Copyright (c) 2012, 2013, 2014, 2015, 2016, 2017 Source Auditor Inc.</defaultFileCopyright>
                    <defaultFileContributors>
                        <defaultFileContributor>Gary O'Neall</defaultFileContributor>
                    </defaultFileContributors>
                    <defaultLicenseInformationInFile>Apache-2.0</defaultLicenseInformationInFile>
                    <defaultFileConcludedLicense>Apache-2.0</defaultFileConcludedLicense>
                    <defaultFileNotice>   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.
   You may obtain a copy of the License at

       http://www.apache.org/licenses/LICENSE-2.0

   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.</defaultFileNotice>
                    <licenseDeclared>Apache-2.0</licenseDeclared>
                    <licenseConcluded>(Apache-2.0 AND MIT AND LicenseRef-CyberNeko AND LGPL-2.1 AND BSD-3-Clause AND X11 AND MPL-1.0)</licenseConcluded>
                    <creators>
                        <creator>Person: Gary O'Neall</creator>
                    </creators>
                    <originator>Organization: Linux Foundation</originator>
					<!-- TODO add documentAnnotations, packageAnnotations, pathsWithSpecificSpdxInfo, externalReferences -->
                </configuration>
            </plugin>
            <plugin>
                <artifactId>maven-compiler-plugin</artifactId>
                <version>3.11.0</version>
            </plugin>
        </plugins>
    </build>
</project>